Comprehensive Performance Assessment on Open Source Intrusion Detection System

Several studies have been conducted where authors compared the performance of open source Intrusion detection systems, namely Snort and Suricata. However, these studies were mostly limited to either security indicators or performance measurements under the same operating system. The objective of this study is to provide a comprehensive analysis of both products in terms of several security and performance related indicators under two different operating systems. Experiments were conducted to evaluate the effects of open source intrusion detection and prevention systems; Snort and Suricata running on Windows and Linux operating system. Attack types on system such as resource usage, dropped packets rate and ability to detect intrusions serve as experiment benchmarks. From the result, Snort is shown to work better in Linux platform in terms of intrusion detection compared to Suricata. In terms of performance in windows platforms, Snort demonstrated lesser intrusion detection than its Linux-based execution. This is different with Suricata, with its Linux configuration shown to be unable to detect any attack executed. The results also indicated that Linux-based execution consumes more system resources than its windows-based counterpart.